Generally, the present application relates to data processing. More specifically, the application is related to techniques for enabling a user to validate the authenticity of a computing system which controls access to resources.
Modern businesses rely on a variety of applications and systems that control and generate information that is critical to business operations. Different applications often provide different services and information, and different users may require access to different levels of information within each system or application. The level of access that users are granted may depend on the role of the user. For example, a manager may need access to certain information about employees that report to him, but it may be improper for that manager to access the same information about those whom he reports to.
Earlier, less sophisticated applications incorporated access management business logic directly into the application code. That is to say, each application would require users to have a separate account, separate policy logic, and separate permissions, for example. Furthermore, when a user is authenticated by one of these applications, this authentication remains unknown to other applications in the enterprise because the fact that authentication with the first application has taken place is not shared. Thus, there is no concept of trust between applications using different systems for authentication and access control. Engineers quickly realized that having an access management system for each application in an enterprise was much like having a gas station for each car, and determined that authentication and access control would be more efficiently implemented and managed as a shared resource. These shared resources became known as an access management systems.
Access management systems often use policies and other business logic to make a determination regarding whether a particular access request should be granted to a particular resource. Upon making a determination that access should be granted, a token is provided to the requestor. This token is like a key that can be used to open a door that guards restricted data. For example, a user may attempt to access a human resources database to gather information about certain employees such as salary information. The user's web browser makes a request to the application, which requires authentication. If the web browser does not have a token, the user is asked to log in to the access management system. When the user is authenticated, the user's browser receives a cookie that represents a token that may be used to access the human resources application.
In an enterprise, users (e.g., employees) typically may have access to one or more different systems and applications. Each of these systems and applications may utilize different access control policies and require different credentials (e.g., user names and passwords). single sign-on (SSO) can provide a user with access to multiple systems and applications after an initial login. For example, when the user logs-in to their work computer, the user can then also have access to one or more other resources, such as systems and applications. An access management system may challenge a user to verify his/her identity to determine access to a resource. The user may be challenged for information based on a combination of “what you have,” “what you know,” and “who you are.”
Access management systems can prompt a user with a graphical user interface on a client device to challenge the user for information to verify the user's credentials. Sometimes, information requested of a user may include sensitive, confidential information, which if comprised, may threaten the identity and personal information (e.g., financial information or account information) of the individual. As a result, users may be hesitant to provide sensitive information to a system, such as a server, to gain access to resources, without being sure that the system requesting the information does actually control access to those resources.
With on-going technology-based advances in identity theft using techniques such as spoofing and phishing, users are even more reluctant to provide their credentials without a way to verify the source of the request for credentials. For example, an access management system may provide private information to the user to let the user determine the authenticity of the access management system based on the private information. However, in this scenario, spoofing and phishing systems may have access to personal information that can be used to lure the user into believing that the system requesting authentication is legitimate. In another example, an access management system may contact another device with a special code for additional verification. However, spoofing systems may have access to a user's contact information, and may use such information to send additional verification information. In yet another example, a phishing or a spoofing system may try to deceive a user by obtaining credential information through a collection page that is not controlled by an access management system. In one scenario, on a client system, a malicious browser plug-in may be activated to act as an access management system to falsely request access credentials from a user.
In some instances, a client system may receive a one-time code (e.g., password) to enable the user operating the client system to access a resource via the access management system. The client system, if compromised or stolen, may enable a user operating the client system to obtain unauthorized access to a resource using the one-time code. Some techniques for identity theft may be used to intercept communications between a client system operated by a user and an access management system. The intercepted communications may be used to solicit identity or access information from a user.
Access management solutions may be challenged to provide users with the ability to enable the user to initiate validation of the system providing access management facilities. New techniques are desired for enabling a user to determine the authenticity of a system requesting credential information to access resources.